openapi-cli4ai 0.5.0__tar.gz → 0.5.1__tar.gz

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/.github/dependabot.yml

@@ -10,7 +10,7 @@ updates:
       actions:
         patterns: ["*"]
 
-  - package-ecosystem: "pip"
+  - package-ecosystem: "uv"
     directory: "/"
     schedule:
       interval: "weekly"

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/.github/workflows/ci.yml

@@ -16,22 +16,22 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
       - name: Sync dependencies
-        run: uv sync --python ${{ matrix.python-version }}
+        run: uv sync --locked --python ${{ matrix.python-version }}
       - name: Run unit tests with coverage
         run: uv run --python ${{ matrix.python-version }} pytest tests/ -m "not integration" -v --cov=openapi_cli4ai --cov-report=term-missing
 
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       - name: Ruff check
         run: uvx ruff check .
       - name: Ruff format check
@@ -40,9 +40,9 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       - name: Sync dependencies
-        run: uv sync
+        run: uv sync --locked
       - name: Run mypy
         run: uv run mypy src/openapi_cli4ai/ --ignore-missing-imports

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/.github/workflows/codeql.yml

@@ -16,8 +16,8 @@ jobs:
   analyze:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           languages: python
-      - uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/.github/workflows/publish.yml

@@ -13,8 +13,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       - name: Build sdist and wheel
         run: uv build
       - name: Upload artifacts
@@ -42,7 +42,7 @@ jobs:
           name: dist
           path: dist/
       - name: Generate attestations
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: dist/*
       - name: Publish to PyPI

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.5.1] - 2026-07-04
+
+### Fixed
+
+- Ingest YAML OpenAPI specs served as `application/vnd.oai.openapi` (e.g. Codecov's schema endpoint), with a YAML fallback when a body advertised as JSON fails to decode (#22)
+- `--version` now derives from installed package metadata instead of a hardcoded literal that had drifted from the real version (#22)
+
+### Changed
+
+- Commit `uv.lock` and use `uv sync --locked` in CI for reproducible builds; Dependabot now updates the lockfile via the `uv` ecosystem (#20)
+- Dependency updates: `typer` 0.26 (with test adjustments for its vendored `click`), plus the python-deps and GitHub Actions groups (#21, #19, #16)
+
 ## [0.5.0] - 2026-04-21
 
 ### Added

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openapi-cli4ai
-Version: 0.5.0
+Version: 0.5.1
 Summary: Turn any REST API with an OpenAPI spec into an AI-ready CLI
 Project-URL: Homepage, https://github.com/dbgorilla/openapi-cli4ai
 Project-URL: Repository, https://github.com/dbgorilla/openapi-cli4ai

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openapi-cli4ai"
-version = "0.5.0"
+version = "0.5.1"
 description = "Turn any REST API with an OpenAPI spec into an AI-ready CLI"
 readme = "README.md"
 license = "MIT"
@@ -44,7 +44,8 @@ openapi-cli4ai = "openapi_cli4ai.cli:app"
 dev = [
     "pytest>=8",
     "pytest-cov>=5",
-    "mypy>=1.10,<2",
+    "click>=8,<9",
+    "mypy>=1.10,<3",
     "types-PyYAML>=6,<7",
 ]
 

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/src/openapi_cli4ai/cli.py

@@ -26,6 +26,7 @@ import base64
 import binascii
 from email.utils import parsedate_to_datetime
 import hashlib
+from importlib.metadata import version as _pkg_version, PackageNotFoundError
 import html as html_module  # noqa: F401 (used by F3: OIDC callback HTML escaping)
 import json
 import os
@@ -56,8 +57,11 @@ from rich.panel import Panel  # noqa: E402
 from rich.table import Table  # noqa: E402
 
 # ── Constants ──────────────────────────────────────────────────────────────────
-VERSION = "0.4.0"
 APP_NAME = "openapi-cli4ai"
+try:
+    VERSION = _pkg_version(APP_NAME)
+except PackageNotFoundError:  # running from a source checkout without an install
+    VERSION = "0.0.0+dev"
 CONFIG_FILE = Path.home() / ".openapi-cli4ai.toml"
 CACHE_DIR = Path.home() / ".cache" / APP_NAME
 CACHE_TTL = 3600  # 1 hour
@@ -458,11 +462,22 @@ def fetch_spec(profile: dict, refresh: bool = False) -> dict:
                 f"Got HTML instead of OpenAPI spec from {spec_url} — the server may have a frontend catch-all route"
             )
 
-        # Handle JSON or YAML
-        if "yaml" in content_type or spec_url.endswith((".yaml", ".yml")):
+        # Handle JSON or YAML. Some servers serve a YAML spec under a
+        # non-obvious media type — e.g. Codecov's schema endpoint returns
+        # "application/vnd.oai.openapi" (the standard OpenAPI YAML type),
+        # which contains neither "yaml" nor a ".yaml" suffix. Prefer JSON
+        # when the type says so (covers the "+json" variant), route known
+        # YAML types to the YAML parser, and fall back to YAML if a body
+        # not advertised as JSON fails to decode.
+        ct = content_type.lower()
+        is_yaml = "yaml" in ct or "vnd.oai.openapi" in ct or spec_url.endswith((".yaml", ".yml"))
+        if is_yaml and "json" not in ct:
             spec = yaml.safe_load(resp.text)
         else:
-            spec = resp.json()
+            try:
+                spec = resp.json()
+            except json.JSONDecodeError:
+                spec = yaml.safe_load(resp.text)
 
         # Write cache atomically to prevent partial writes
         ensure_dirs()

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_auth.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import base64
 
 import pytest
-from click.exceptions import Exit as ClickExit
+from typer import Exit as ClickExit
 
 
 def test_auth_none(cli_module):

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_auth_flow_security.py

@@ -62,9 +62,9 @@ class TestOAuthBearer:
         }
         token_cache.write_text(json.dumps(token_data))
 
-        import click
+        import typer
 
-        with pytest.raises(click.exceptions.Exit):
+        with pytest.raises(typer.Exit):
             cli._oauth_bearer(profile, profile["auth"])
 
 

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_auth_flows.py

@@ -9,7 +9,7 @@ from unittest.mock import MagicMock, patch
 
 import httpx
 import pytest
-from click.exceptions import Exit as ClickExit
+from typer import Exit as ClickExit
 
 from openapi_cli4ai import cli as cli_mod
 

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_caching.py

@@ -105,3 +105,81 @@ def test_fetch_spec_stale_cache_triggers_fetch(tmp_config, petstore_spec):
         mock_make_client.return_value = mock_ctx
         result = mod.fetch_spec(profile)
         assert result["info"]["title"] == petstore_spec["info"]["title"]
+
+
+def _fetch_with_mocked_response(mod, profile, response):
+    """Run fetch_spec with _make_client mocked to return `response` from a fresh fetch."""
+    # raise_for_status() needs a request attached to the response.
+    response.request = httpx.Request("GET", profile.get("openapi_url", profile["base_url"]))
+    mock_client = MagicMock()
+    mock_client.get = MagicMock(return_value=response)
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__ = MagicMock(return_value=mock_client)
+    mock_ctx.__exit__ = MagicMock(return_value=False)
+    with patch("openapi_cli4ai.cli._make_client", return_value=mock_ctx):
+        return mod.fetch_spec(profile)
+
+
+def test_fetch_spec_parses_yaml_vnd_oai_media_type(tmp_config):
+    """Should parse a YAML spec served as application/vnd.oai.openapi (e.g. Codecov)."""
+    mod, _config_dir, _cache_dir = tmp_config
+    profile = {
+        "base_url": "https://api.codecov.io/api/v2",
+        "openapi_url": "https://api.codecov.io/api/v2/schema/",
+        "auth": {"type": "none"},
+        "verify_ssl": True,
+        "_name": "codecov",
+    }
+    yaml_spec = (
+        "openapi: 3.0.3\n"
+        "info:\n  title: Codecov API\n  version: 2.0.0\n"
+        "paths:\n  /repos/:\n    get:\n      summary: List repos\n"
+    )
+    response = httpx.Response(
+        200,
+        content=yaml_spec.encode(),
+        headers={"content-type": "application/vnd.oai.openapi; charset=utf-8"},
+    )
+    spec = _fetch_with_mocked_response(mod, profile, response)
+    assert spec["info"]["title"] == "Codecov API"
+    assert "/repos/" in spec["paths"]
+
+
+def test_fetch_spec_falls_back_to_yaml_on_mislabeled_json(tmp_config):
+    """Should fall back to YAML when a body advertised as JSON is actually YAML."""
+    mod, _config_dir, _cache_dir = tmp_config
+    profile = {
+        "base_url": "https://example.com",
+        "openapi_url": "https://example.com/schema",
+        "auth": {"type": "none"},
+        "verify_ssl": True,
+        "_name": "mislabeled",
+    }
+    yaml_spec = "openapi: 3.0.3\ninfo:\n  title: Mislabeled\n  version: 1.0.0\npaths: {}\n"
+    response = httpx.Response(
+        200,
+        content=yaml_spec.encode(),
+        headers={"content-type": "application/json"},  # server lies
+    )
+    spec = _fetch_with_mocked_response(mod, profile, response)
+    assert spec["info"]["title"] == "Mislabeled"
+
+
+def test_fetch_spec_parses_vnd_oai_openapi_json_variant(tmp_config):
+    """The +json variant should still parse via the JSON path."""
+    mod, _config_dir, _cache_dir = tmp_config
+    profile = {
+        "base_url": "https://api.codecov.io/api/v2",
+        "openapi_url": "https://api.codecov.io/api/v2/schema/?format=json",
+        "auth": {"type": "none"},
+        "verify_ssl": True,
+        "_name": "codecovjson",
+    }
+    json_spec = json.dumps({"openapi": "3.0.3", "info": {"title": "Codecov API", "version": "2.0.0"}, "paths": {}})
+    response = httpx.Response(
+        200,
+        content=json_spec.encode(),
+        headers={"content-type": "application/vnd.oai.openapi+json"},
+    )
+    spec = _fetch_with_mocked_response(mod, profile, response)
+    assert spec["info"]["title"] == "Codecov API"

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_commands.py

@@ -1210,6 +1210,12 @@ class TestMainCallback:
         assert "openapi-cli4ai" in result.output
         assert mod.VERSION in result.output
 
+    def test_version_derived_from_package_metadata(self, cli_module):
+        """VERSION comes from installed package metadata, not a hardcoded literal."""
+        from importlib.metadata import version
+
+        assert cli_module.VERSION == version("openapi-cli4ai")
+
     def test_no_subcommand_shows_help(self, tmp_config):
         mod, tmp_path, cache_dir = tmp_config
 

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_coverage_gaps.py

@@ -10,7 +10,7 @@ from unittest.mock import MagicMock, patch
 import httpx
 import pytest
 import tomli_w
-from click.exceptions import Exit as ClickExit
+from typer import Exit as ClickExit
 from typer.testing import CliRunner
 
 from openapi_cli4ai.cli import app

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_device_flow.py

@@ -9,7 +9,7 @@ import time
 from unittest.mock import MagicMock, patch
 
 import pytest
-from click.exceptions import Exit as ClickExit
+from typer import Exit as ClickExit
 
 
 # ── Device flow endpoint discovery ────────────────────────────────────────────

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_error_handling.py

@@ -10,7 +10,7 @@ import inspect
 import socket
 from unittest.mock import MagicMock, patch
 
-import click
+import typer
 import pytest
 
 from openapi_cli4ai import cli as cli_mod
@@ -41,7 +41,7 @@ class TestSpecificExceptions:
             mock_client.get.side_effect = httpx.ConnectError("mocked connection error")
             mock_mc.return_value = mock_client
 
-            with pytest.raises(click.exceptions.Exit):
+            with pytest.raises(typer.Exit):
                 cli.fetch_spec(profile, refresh=True)
 
     def test_try_refresh_token_catches_specific_errors(self, tmp_config):
@@ -113,7 +113,7 @@ class TestOIDCServerCleanup:
             sock.listen(1)
 
             # Calling _oidc_login_browser on this port should exit cleanly
-            with pytest.raises(click.exceptions.Exit):
+            with pytest.raises(typer.Exit):
                 cli_mod._oidc_login_browser("http://auth.example.com/authorize", port, "test_state")
         finally:
             sock.close()

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_oidc.py

@@ -8,7 +8,7 @@ import json
 import time
 
 import pytest
-from click.exceptions import Exit as ClickExit
+from typer import Exit as ClickExit
 
 
 def test_oidc_auth_returns_cached_token(cli_module, tmp_config):

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_security.py

@@ -11,7 +11,7 @@ import stat
 import urllib.parse
 from unittest.mock import patch
 
-import click
+import typer
 import pytest
 from typer.testing import CliRunner
 
@@ -317,7 +317,7 @@ class TestOIDCStateValidation:
         # Mock typer.prompt to return a URL with wrong state
         wrong_url = "http://localhost:8484/callback?code=abc123&state=WRONG"
         with patch("typer.prompt", return_value=wrong_url):
-            with pytest.raises(click.exceptions.Exit):
+            with pytest.raises(typer.Exit):
                 cli_mod._oidc_login_no_browser("http://auth.example.com", expected_state="CORRECT")
 
     def test_no_browser_accepts_correct_state(self):
@@ -331,7 +331,7 @@ class TestOIDCStateValidation:
         """_oidc_login_no_browser should reject a redirect URL with no state."""
         no_state_url = "http://localhost:8484/callback?code=abc123"
         with patch("typer.prompt", return_value=no_state_url):
-            with pytest.raises(click.exceptions.Exit):
+            with pytest.raises(typer.Exit):
                 cli_mod._oidc_login_no_browser("http://auth.example.com", expected_state="EXPECTED")
 
 
@@ -489,7 +489,7 @@ class TestProfileFallbackWarning:
             }
         )
         monkeypatch.setenv("OAC_PROFILE", "nonexistent")
-        with pytest.raises(click.exceptions.Exit):
+        with pytest.raises(typer.Exit):
             cli.get_active_profile()
         captured = capsys.readouterr()
         assert "not found" in captured.err.lower()
@@ -635,21 +635,21 @@ class TestConfigCorruption:
         """A corrupt TOML config should exit with error, not silently return empty."""
         cli, config_path, cache_dir = tmp_config
         cli.CONFIG_FILE.write_text("this is not valid toml {{{")
-        with pytest.raises(click.exceptions.Exit):
+        with pytest.raises(typer.Exit):
             cli.load_profiles()
 
     def test_wrong_shape_profiles_exits(self, tmp_config):
         """Config with profiles = 'string' should exit, not crash."""
         cli, config_path, cache_dir = tmp_config
         cli.CONFIG_FILE.write_text('profiles = "oops"\n')
-        with pytest.raises(click.exceptions.Exit):
+        with pytest.raises(typer.Exit):
             cli.load_profiles()
 
     def test_wrong_shape_nested_profile_exits(self, tmp_config):
         """Config with [profiles] bad = 'string' should exit, not crash."""
         cli, config_path, cache_dir = tmp_config
         cli.CONFIG_FILE.write_text('[profiles]\nbad = "oops"\n')
-        with pytest.raises(click.exceptions.Exit):
+        with pytest.raises(typer.Exit):
             cli.get_active_profile()
 
 

{openapi_cli4ai-0.5.0 → openapi_cli4ai-0.5.1}/tests/test_v040_hardening.py

@@ -11,7 +11,7 @@ from __future__ import annotations
 import inspect
 from unittest.mock import MagicMock, patch
 
-import click.exceptions
+import typer
 import httpx
 import pytest
 
@@ -65,7 +65,7 @@ class TestTokenExchangeHardening:
         mock_ctx.__exit__ = MagicMock(return_value=False)
 
         with patch.object(cli_module, "_make_client", return_value=mock_ctx):
-            with pytest.raises(click.exceptions.Exit):
+            with pytest.raises(typer.Exit):
                 cli_module._token_exchange(
                     {"access_token": "tok"},
                     auth_config,
@@ -128,7 +128,7 @@ class TestDeviceLoginHardening:
             patch.object(cli_module, "_device_discover_endpoints", return_value=endpoints),
             patch.object(cli_module, "_make_client", return_value=mock_ctx),
         ):
-            with pytest.raises(click.exceptions.Exit):
+            with pytest.raises(typer.Exit):
                 cli_module._device_login(auth_config, "test-profile", profile)